You're not supposed to run apt upgrade in Proxmox at all, it may even break your system. Use dist-upgrade.
https://pve.proxmox.com/pve-docs/chapter-sysadmin.html#system_software_updates
this post was submitted on 02 May 2026
105 points (93.4% liked)
Selfhosted
60831 readers
921 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
Just don’t use any command in proxmox. Proxmox is designed GUI first. It got an update button in the GUI. Only major releases could need tinkering in the terminal. But even changing repos is now possible in the GUI.
Gets annoying soon if you have more than one host. Easily automated with Ansible
gotta love that GUI, that bombards you with reminders to subscribe to their paid tier repository constantly and won't let you update...
also, provides no methodology to control when it wants to overwrite a config or when a externally added signable dkms exists and creates a prompt during dkms building.
the gui is nice, but it's far from perfect...
I'm curious, how might apt upgrade break something in Proxmox?
I don't know, I've seen it several times mentioned in the Proxmox forum. I think it's more of a theoretical scenario but it's strongly advised against.
Hmm. Welp. Let’s try. See what happens.
I've seen that the patches are only available in the debian-security repository. It's important to review your repo list in /etc/apt/sources.list.d.
Proxmox does not use the standard debian kernel.
Yes, I referred to the Debian part only.
I mean, you could just use the proxmox UI for updates. Single point for all servers, just click in and hit update. It explicitly runs dist-upgrade already.
Is this just a Proxmox thing? I'm running Debian on my server, and as far as I know, the kernel has always upgraded properly when there's a new one available.
Ooof, scared me there for a second. Good thing I am using Dist-Upgrade in my ansible scripts.
The nice thing about zypper is the various patch options and reporting. Gives you a good picture of what CVEs, rating, and if installed, needed, not needed etc. Does Apt have something similar?
from my own experience, apt dist-upgrade removes old kernels, apt upgrade still installed the new kernel, grub updated and booted into the new kernel.
all dist-upgrade did (for me) was delete the old kernels. which is something I would prefer not to do because it removes any ability to rollback should I absolutely need to.
Which distro? Debian for example always keeps two kernels: the curent one and the one in use before that, which is what I prefer, never had to rely on more than one backup kernel.
Debian. like the Debian.
currently running Trixie on my daily and bookworm on a couple servers which will be upgraded to Trixie soon.
@GreenKnight23 @oong3Eepa1ae1tahJozoosuu I've never seen that behavior in Debian. Is that some different type of configuration?
native config. nothing special.
@GreenKnight23 I don't see that behavior. Rebooting into a new kernel and then running dist-upgrade, it always _always_ keeps one older kernel around. Bookworm and trixie.
You only need the reboot if a package update masks the retirement.
The system is not lying to you, it holds some critical updates back to be installed separately and manually.
The output shows you which packages have been held back. Just do apt-get install linux-image-amd64 for example, reboot and apt autoremove to remove the old kernel.
I honestly don't know what your talking about. proxmox updated the pve kernels immediately after this CVE was published....
additionally, this CVE only applies to older (pre-6.17 kernels). unless you are on proxmox 8 or earlier, you are already running a "patched" kernel as the pathway necessary for this was changed and in kernel 7.x and above this CVE doesnt work...